Email Security EUVD-2026-17640

While CVSS and EPSS scores are unavailable, this vulnerability carries moderate-to-high real-world risk despite authentication requirements. The threat model is significant because: (1) SonicWall Email Security appliances are high-value targets in enterprise networks, handling sensitive email traffic; (2) admin account compromise is a common post-breach objective for attackers seeking persistent access; (3) stored XSS in management interfaces can lead to lateral movement, credential capture, or malware distribution to managed email systems; (4) the appliance's central role in email infrastructure means successful exploitation affects all users whose sessions interact with the poisoned web interface. The authentication requirement (admin-only) reduces exposure surface compared to unauthenticated XSS, but does not eliminate risk in scenarios involving compromised admin credentials, disgruntled insiders, or supply-chain attacks. Without CVSS vector data, exploit complexity and impact scope cannot be formally assessed, but stored XSS in privileged interfaces typically rates high impact for confidentiality and integrity of the management plane.

An attacker with a compromised SonicWall Email Security admin account (obtained via phishing, credential stuffing, or insider access) logs into the web management console and injects a stored XSS payload into a configuration field such as a custom email filter rule name, email gateway setting, or admin message banner. When other administrators or support staff access the appliance to review configurations or check system status, their browsers execute the injected JavaScript in the context of the SonicWall management session. The attacker's payload can harvest session cookies, redirect the admin to a phishing page mimicking SonicWall authentication, or inject further malicious actions that modify email routing rules or exfiltrate security logs. No public exploit code has been independently confirmed at the time of analysis; exploitation requires valid admin credentials and interaction with the vulnerable web interface.